U.S. patent application number 10/333381 was filed with the patent office on 2003-07-10 for method for addressing terminals.
Invention is credited to Schwenk, Joerg.
Application Number | 20030128846 10/333381 |
Document ID | / |
Family ID | 7651063 |
Filed Date | 2003-07-10 |
United States Patent
Application |
20030128846 |
Kind Code |
A1 |
Schwenk, Joerg |
July 10, 2003 |
Method for addressing terminals
Abstract
The invention relates to a method for addressing terminals for
receiving television programs that are subject to charges, whereby
the terminals are divided into groups each having a group address,
and an identifier within the group is assigned to each of the
terminals of each group. According to the invention, said
identifier is a binary vector. The group address and a data item
are sent in order to address terminals of group. The data item is
formed by logically linking the binary vectors with another binary
vector that describes which of the terminals of the group should be
addressed. The linking is preferably carried out by forming a
binary matrix consisting of the binary vectors and by multiplying
the binary matrix with the other vector.
Inventors: |
Schwenk, Joerg; (Henfenfeld,
DE) |
Correspondence
Address: |
DAVIDSON, DAVIDSON & KAPPEL, LLC
485 SEVENTH AVENUE, 14TH FLOOR
NEW YORK
NY
10018
US
|
Family ID: |
7651063 |
Appl. No.: |
10/333381 |
Filed: |
January 17, 2003 |
PCT Filed: |
July 9, 2001 |
PCT NO: |
PCT/EP01/07853 |
Current U.S.
Class: |
380/242 ;
348/E7.061 |
Current CPC
Class: |
H04N 7/163 20130101;
H04L 61/00 20130101; H04N 21/6402 20130101; H04H 2201/70 20130101;
H04N 21/4516 20130101; H04H 60/14 20130101; H04N 21/454
20130101 |
Class at
Publication: |
380/242 |
International
Class: |
H04N 007/167 |
Foreign Application Data
Date |
Code |
Application Number |
Aug 2, 2000 |
DE |
100 37 630.4 |
Claims
What is claimed is:
1. A method for addressing terminals for receiving television
programs that are subject to charge, the terminals being divided
into groups which each have a group address, and each of the
terminals of a group being assigned an identifier within the group,
wherein the identifier is a binary vector; in order to address
terminals of a group, the group address and a data word are sent;
and the data word is generated by logically combining the binary
vectors with a further binary vector that describes which of the
terminals of the group are to be addressed.
2. The method as recited in claim 1, wherein the combination is
performed by forming a binary matrix from the binary vectors and by
multiplying the binary matrix by the further vector.
3. The method as recited in claim 2, wherein the further binary
vector contains a bit position for each terminal of the group, the
bit position being set to a predetermined value if the terminal is
to be addressed.
4. The method as recited in one of the claims 2 or 3, wherein the
binary vector which is assigned to the terminal and stored in the
terminal is multiplied by the transmitted data word; and the
addressing is considered to be completed when this multiplication
yields a predetermined binary value.
Description
[0001] The present invention relates to a method for addressing
terminals for receiving television programs that are subject to
charge, the terminals being divided into groups which each have a
group address, and each of the terminals of a group being assigned
an identifier within the group.
[0002] In systems for receiving television programs that are
subject to charge (also referred to as pay-TV systems), it must be
ensured that the programs that are subject to charge can only be
received by the customers who are entitled thereto. This is
accomplished by encoding the program contents, by storing reception
rights in the security module of the terminal, and by adding
reception conditions to the program.
[0003] Terminals for receiving programs which are subject to charge
are known as so-called set-top boxes or decoders . However, other
terminals are possible as well, such as PC cards or PCMCIA modules.
It is also possible to integrate suitable terminals into the
television receiver.
[0004] Mostly used as security modules are chip cards which are not
are not firmly connected to the terminal but able to be removed
therefrom. Because of this, one and the same terminal can be used
by different users using an individual security module,
respectively. However, in the context of the present invention, the
terminal itself together with the respective used security module
are regarded as a terminal.
[0005] The program contents are encoded under the control of a
so-called control word CW, with the DVB (=digital video
broadcasting) Common Scrambling Algorithm being mainly used as the
algorithm in MPEG-2 standard-based digital television in Europe.
However, other algorithms have become known as well.
[0006] Reception conditions are added to a program in the form of
so-called Entitlement Control Messages (ECM) which are transmitted
with the program content. These ECMs are firmly associated with a
program content. Besides the reception conditions, ECMs also
contain the encrypted control word CW and a cryptographic checksum
MAC to prevent manipulations.
[0007] Reception rights are transmitted in the form of so-called
Entitlement Management Messages (EMM) in the same medium (cable,
satellite, terrestrial broadcasting, ADSL) as the program contents.
However, they are not firmly linked to the respective program
content but to the logical address of the terminal of the customer
or to that of the security module. EMMs can be addressed to
individual customers or to groups of customers. Usually, EMMs
contain also a service key SK in encrypted form in addition to the
reception rights. This service key is required to reverse the
encryption of the control words in the ECMs. EMMs can be
(optionally partially) encrypted or unencrypted, but are protected
from manipulations by a cryptographic checksum (MAC). An
application of CW, ECM and EMM is described, for example, in German
Patent Application DE 196 30 707 A1.
[0008] In many conditional access systems currently used, there
exists a mechanism for addressing subsets of certain groups of
terminals. To this end, the security modules of all customers are
divided into groups of fixed size, generally 256=2.sup.8. Each
group gets a group address and each customer is assigned an
identifier by a position within the group. This position is added
to die group address as a bitmap of the size 256. If the bit i in
the bitmap is set to 1, then this means that the EMM concerns the
customer who occupies the position i within the group. A 0 means
that the EMM does not concern the terminal with the respective
position. Thus, it is possible to address arbitrary subsets 1 to
256 of the group.
[0009] The security of this described method is now based on that
the bitmaps in the EMMs cannot be changed, which is ensured by the
MAC at the end of the EMM. However, attacks have become known where
the MAC was falsified, thus allowing the bitmap to be falsified as
well.
[0010] The object of the present invention is to make the
addressing of the terminals more secure. In this context, the
intention is for the computational effort to be as small as
possible, in particular, in the terminal or in the security module
because a great number of incoming EMMs must possibly be checked
there.
[0011] This objective is achieved according to the present
invention in that the identifier is a binary vector, that, in order
to address terminals of a group, the group address and a data word
are sent, and that the data word is generated by logically
combining the binary vectors with a further binary vector that
describes which of the terminals of the group are to be
addressed.
[0012] One embodiment of the method according to the present
invention, which is particularly beneficial in terms of
computational effort, consists in that the combining is performed
by forming a binary matrix from the binary vectors and by
multiplying the binary matrix by the further vector. In this
context, preferably, provision is made for the further binary
vector to contain a bit position for each terminal of the group,
the bit position being set to a predetermined value if the terminal
is to be addressed.
[0013] In the terminal or in the security module, the data word
according to the present invention is preferably evaluated in that
the binary vector which is assigned to the terminal and stored in
the terminal is multiplied by the transmitted data word and in that
the addressing is considered to be completed when this
multiplication yields a predetermined binary value.
[0014] An exemplary embodiment of the present invention is depicted
in the drawing with reference to several Figures and will be
explained in greater detail in the following description.
[0015] FIG. 1 shows a flow chart to illustrate the method steps
carried out at the transmitter end;
[0016] FIG. 2 shows a flow chart to illustrate the method steps
carried out at the terminal end;
[0017] FIG. 3 shows the formation of a matrix containing the binary
vectors;
[0018] FIG. 4 depicts the generation of the data word to be
transmitted; and
[0019] FIG. 5 illustrates the evaluation of the transmitted data
word.
[0020] The flow charts shown in FIGS. 1 and 2 represent parts of
programs which are executed at the transmitter end and in the
security module or terminal as far as they concern the method
according to the present invention. At the transmitter end, after
starting at 1, vector u is read in which specifies the terminals to
which an EMM is to be sent. Read-in vector u represents a
single-row matrix which is transformed into matrix u.sup.T at
2.
[0021] In the next method step 3, a matrix is read in whose rows
each represent a binary vector which is assigned to a terminal and
has the length k. Data word x.sup.T to be transmitted is obtained
by multiplication of inverted matrix A.sup.-1 by matrix u.sup.T. At
4, the data word is added to the EMM to be transmitted. At 5, the
EMM, including data word x.sup.T, is transmitted to the terminals
via the respective medium. After that, the program is terminated at
6 or repeated to address further terminals.
[0022] In the terminal, after a program start 7, an EMM is
identified in the incoming data stream at 8, and data word x.sup.T
is separated from therefrom at 9. In program step 10, data word
x.sup.T is then multiplied by the stored, individual vector v.sub.i
of terminal i. If terminal i is addressed, result b is equal to 1,
which is checked at 11, whereupon the EMM is processed at 12 using
the known cryptographic methods.
[0023] However, if b=0, this means that the received EMM is not
intended for this terminal. The program is then terminated at 13,
without the EMM being processed further, i.e., for example, without
the terminal being enabled to receive the respective programs.
[0024] In the numerical example shown in FIG. 3, binary vectors
v.sub.1 through v.sub.5 of five terminals each constitute a row of
a matrix A. This matrix is inverted and, according to FIG. 4, is
multiplied, as a matrix A.sup.-1, by matrix u.sup.T which says the
first, the second and the fifth terminal of this group are to be
addressed. A further matrix x.sup.T is formed by multiplication,
the further matrix being added to the EMM as a data word.
[0025] FIG. 5 shows the checking of the data word in the receiver
on the basis of the same numerical example for the receiver whose
binary vector is v.sub.1. This vector, which is stored in the
security module, is multiplied by x.sup.T, which yields 1 in the
example shown.
* * * * *